CSR Decoder
Inspect a request and verify its signature before submission.
Try before you buy.
- Free preview: the rules, dates and checks that apply to your figures, with every computed amount hidden.
- Locked until you unlock it: download and copy.
- Unlock: Pro pass, ₹179 for 30 days or ₹79 for 1 week, a one-time payment that never renews. Unlock: Pro pass, $5.99 for 30 days or $2.99 for 1 week, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
| Quantity | Value |
|---|
Format, privacy and use notes
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the CSR Decoder
Decode a PKCS#10 certificate signing request to inspect its subject, public key, signature algorithm and requested extensions, including DNS/IP subject alternative names. The local calculation checks the request’s self-signature and screens common TLS-policy issues such as missing SANs, weak RSA and non-public common names.
The verification verdict and warnings remain readable in the free preview. A Pro pass opens the full decoded details, SPKI fingerprint, copy and report downloads. Issuers decide whether to accept a request and may replace or omit requested extensions.
How to use it
- Paste one complete CERTIFICATE REQUEST PEM block or choose its text file.
- Decode it and read the self-signature status and screening warnings.
- With a pass, inspect the subject, public key, SANs, signature algorithm and extension requests.
- Copy or download the decoded report with a pass; confirm the issuing authority’s requirements separately.
Format and verification
A PKCS#10 request signs CertificationRequestInfo with its private key. Verification checks that signature against the included public key. The request’s subject/extensions express desired content and are not an issued certificate.
Sources
PKCS#10 structure, X.509 extensions and public TLS baseline requirements.
Limitations
- A valid self-signature proves mathematical possession at creation, not identity validation, issuance or public trust.
- Policy warnings are screening hints, not a complete certificate-authority compliance audit.
- Unsupported legacy signature algorithms may be reported unverified; use a compatible local verifier instead of assuming validity.
Privacy
On this device; its files download once
Inputs, passwords, generated private keys and selected files stay on this device. The tool makes no domain/authority lookup, upload or persistent key store. Reset or leaving the page discards its result.
Frequently asked questions
What do I get without a pass?
Without a pass, CSR Decoder shows the rules, dates and checks that apply to your figures, with every computed amount hidden. Until you unlock it, the result can’t be downloaded or copied. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
Do I need the private key?
No. The CSR includes the public key needed for self-signature verification. Keep the private key separate.
Does a valid signature mean the CA will accept it?
An issuer applies identity and certificate policy checks as well. A mathematically valid request can still be rejected or changed.
What does a missing SAN warning mean?
For public TLS, intended DNS or IP identities normally need explicit subject alternative names. Local/private requests may follow different policy.